Skip to content
This repository was archived by the owner on Feb 13, 2025. It is now read-only.

Commit d6706e6

Browse files
TravisEz13TravisEz13
authored
Create OneBranch Pipeline to build and release snap packages (#107)
1 parent d5cc7d7 commit d6706e6

9 files changed

+505
-0
lines changed

‎.config/tsaoptions.json

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{
2+
"instanceUrl": "https://msazure.visualstudio.com",
3+
"projectName": "One",
4+
"areaPath": "One\\MGMT\\Compute\\Powershell\\Powershell\\PowerShell Core",
5+
"notificationAliases": [
6+
"[email protected]",
7+
"[email protected]",
8+
"[email protected]",
9+
"[email protected]"
10+
]
11+
}

‎.pipelines/PowerShell-Snap-Official.yml

+97
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
2+
parameters:
3+
- name: release
4+
type: string
5+
displayName: |
6+
Use `stable` to release by default.
7+
8+
Use `private` if you want to create a branch on the store to test the package.
9+
This will create a branch under the edge branch automatically that are difficult, but not impossible to find.
10+
11+
`candidate`, `beta`, and `edge` are public but we don't have any existing meaning for these channels.
12+
values:
13+
- private
14+
- stable
15+
- candidate
16+
- beta
17+
- edge
18+
default: stable
19+
20+
trigger: none
21+
22+
variables:
23+
- name: CDP_DEFINITION_BUILD_COUNT
24+
value: $[counter('', 0)] # needed for onebranch.pipeline.version task
25+
- name: LinuxContainerImage
26+
value: mcr.microsoft.com/onebranch/cbl-mariner/build:2.0 # Docker image which is used to build the project
27+
- name: DEBIAN_FRONTEND
28+
value: noninteractive
29+
- group: poolNames
30+
31+
resources:
32+
repositories:
33+
- repository: templates
34+
type: git
35+
name: OneBranch.Pipelines/GovernedTemplates
36+
ref: refs/heads/main
37+
38+
extends:
39+
template: v2/OneBranch.Official.CrossPlat.yml@templates
40+
parameters:
41+
git:
42+
fetchDepth: 1
43+
# windows only feature
44+
#longpaths: true
45+
retryCount: 3
46+
# we don't use this and some of our agents doesn't have the feature installed
47+
lfs: false
48+
cloudvault:
49+
enabled: false # set to true to enable cloudvault
50+
runmode: stage # linux can run CloudVault upload as a separate stage
51+
dependsOn: linux_build
52+
artifacts:
53+
- drop_linux_stage_linux_job
54+
customTags: 'ES365AIMigrationTooling'
55+
globalSdl:
56+
disableLegacyManifest: true
57+
# disabled Armorty as we dont have any ARM templates to scan. It fails on some sample ARM templates.
58+
armory:
59+
enabled: false
60+
sbom:
61+
enabled: true
62+
compiled:
63+
enabled: false
64+
credscan:
65+
enabled: true
66+
scanFolder: $(Build.SourcesDirectory)
67+
cg:
68+
enabled: true
69+
asyncSdl: # https://aka.ms/obpipelines/asyncsdl
70+
enabled: true
71+
forStages: [scan_lts, scan_stable, scan_preview]
72+
credscan:
73+
enabled: true
74+
scanFolder: $(Build.SourcesDirectory)
75+
#suppressionsFile: $(Build.SourcesDirectory)\PowerShell\.config\suppress.json
76+
binskim:
77+
enabled: false
78+
# APIScan requires a non-Ready-To-Run build
79+
apiscan:
80+
enabled: false
81+
tsaOptionsFile: .config\tsaoptions.json
82+
83+
stages:
84+
- template: /.pipelines/templates/releaseBuildAndPushStage.yml@self
85+
parameters:
86+
channel: stable
87+
release: ${{ parameters.release }}
88+
89+
- template: /.pipelines/templates/releaseBuildAndPushStage.yml@self
90+
parameters:
91+
channel: preview
92+
release: ${{ parameters.release }}
93+
94+
- template: /.pipelines/templates/releaseBuildAndPushStage.yml@self
95+
parameters:
96+
channel: lts
97+
release: ${{ parameters.release }}

‎.pipelines/templates/Approval.yml

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
parameters:
2+
- name: displayName
3+
type: string
4+
- name: instructions
5+
type: string
6+
- name: jobName
7+
type: string
8+
- name: timeoutInMinutes
9+
type: number
10+
# 2 days
11+
default: 2880
12+
- name: onTimeout
13+
type: string
14+
default: 'reject'
15+
values:
16+
- resume
17+
- reject
18+
19+
jobs:
20+
- job: ${{ parameters.jobName }}
21+
displayName: ${{ parameters.displayName }}
22+
pool:
23+
type: agentless
24+
timeoutInMinutes: 4320 # job times out in 3 days
25+
steps:
26+
- task: ManualValidation@0
27+
displayName: ${{ parameters.displayName }}
28+
timeoutInMinutes: ${{ parameters.timeoutInMinutes }}
29+
inputs:
30+
instructions: ${{ parameters.instructions }}
31+
onTimeout: ${{ parameters.onTimeout }}

‎.pipelines/templates/InstallSnapd.yml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
steps:
2+
3+
- bash: |
4+
sudo apt update
5+
displayName: Apt Update
6+
condition: succeeded()
7+
8+
- bash: |
9+
sudo apt-get -y install snapd
10+
displayName: Install snapd
11+
condition: succeeded()

‎.pipelines/templates/createOutputDirectory-linux.yml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
steps:
2+
3+
- bash: |
4+
mkdir -p -m a=rwx $(ob_outputDirectory)
5+
displayName: Create $(ob_outputDirectory)
6+
condition: succeeded()

‎.pipelines/templates/pushJob.yml

+111
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
parameters:
2+
- name: channel
3+
type: string
4+
- name: release
5+
default: 'private'
6+
7+
jobs:
8+
- job: push
9+
displayName: Push to ${{ parameters.release }}
10+
11+
pool:
12+
type: linux
13+
isCustom: true
14+
name: $(ubuntuPool)
15+
demands:
16+
- ImageOverride -equals PSMMSUbuntu20.04-Secure
17+
18+
variables:
19+
- name: ReleaseTag
20+
value: edge/default
21+
- group: SnapLogin
22+
- name: channel
23+
value: ${{ parameters.channel }}
24+
- name: ob_outputDirectory
25+
value: '$(Build.ArtifactStagingDirectory)/out'
26+
- name: DOWNLOAD_DIRECTORY
27+
value: '$(Build.ArtifactStagingDirectory)/down'
28+
29+
steps:
30+
- checkout: self
31+
lfs: false
32+
33+
- template: ./createOutputDirectory-linux.yml
34+
35+
- task: DownloadPipelineArtifact@2
36+
displayName: 'Download build files'
37+
inputs:
38+
targetPath: $(DOWNLOAD_DIRECTORY)
39+
artifact: drop_build_$(channel)_build_$(channel)
40+
41+
- pwsh: |
42+
$snaps = Get-ChildItem $(DOWNLOAD_DIRECTORY)/*.snap -recurse -File
43+
if($snaps.Count -gt 1)
44+
{
45+
$snaps | out-string -width 100 | Write-Verbose -verbose
46+
Write-Error "***More than one snap found***" -errorAction stop
47+
}
48+
displayName: Verify that only one snap was downloaded
49+
50+
- pwsh: |
51+
[string]$Branch=$env:BUILD_SOURCEBRANCH
52+
$branchOnly = $Branch -replace '^refs/heads/';
53+
$branchOnly = $branchOnly -replace '[_\-]'
54+
55+
if('${{ parameters.release }}' -eq 'private') {
56+
if($branchOnly -eq 'master' -or $branchOnly -like '*dailytest*')
57+
{
58+
Write-verbose "release branch: $branchOnly" -verbose
59+
$generatedBranch = ([guid]::NewGuid()).ToString().Replace('-','')
60+
$releaseTag = "edge/$generatedBranch"
61+
}
62+
else
63+
{
64+
Write-verbose "non-release branch" -verbose
65+
# Branch is named <previewname>
66+
$releaseTag = "edge/$branchOnly"
67+
$releaseTag += ([guid]::NewGuid()).ToString().Replace('-','')
68+
}
69+
}
70+
else {
71+
$releaseTag = "${{ parameters.release }}"
72+
}
73+
74+
$vstsCommandString = "vso[task.setvariable variable=ReleaseTag]$releaseTag"
75+
Write-Verbose -Message "setting ReleaseTag to $releaseTag" -Verbose
76+
Write-Host -Object "##$vstsCommandString"
77+
displayName: Set ReleaseTag Variable
78+
79+
- pwsh: |
80+
sudo chown root:root /
81+
displayName: 'Make sure root owns root'
82+
condition: succeeded()
83+
84+
- template: ./InstallSnapd.yml
85+
86+
- pwsh: |
87+
$channel = (Get-Content ./snapcraftConfig.json | ConvertFrom-Json).channel
88+
Write-Verbose -Verbose -Message "using Channel $channel"
89+
sudo snap install snapcraft --classic "--channel=$channel"
90+
condition: succeeded()
91+
displayName: 'Install snapcraft'
92+
retryCountOnTaskFailure: 2
93+
94+
- pwsh: |
95+
$track = 'latest'
96+
if('$(channel)' -eq 'lts')
97+
{
98+
$track = 'lts'
99+
}
100+
101+
$snaps = Get-ChildItem $(System.ArtifactsDirectory)/*.snap -recurse -File | Select-Object -ExpandProperty FullName
102+
103+
foreach($snap in $snaps)
104+
{
105+
Write-Verbose -Verbose -Message "Uploading $snap to $track/$(ReleaseTag)"
106+
snapcraft upload --release "$track/$(ReleaseTag)" $snap
107+
}
108+
displayName: 'snapcraft upload'
109+
retryCountOnTaskFailure: 1
110+
env:
111+
SNAPCRAFT_STORE_CREDENTIALS: $(SNAPCRAFT_STORE_CREDENTIALS)

‎.pipelines/templates/releaseBuildAndPushStage.yml

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
parameters:
2+
- name: channel
3+
default: ''
4+
- name: release
5+
default: 'private'
6+
7+
stages:
8+
- stage: build_${{ parameters.channel }}
9+
displayName: Build - ${{ parameters.channel }}
10+
dependsOn: []
11+
jobs:
12+
- template: ./releaseBuildJob.yml
13+
parameters:
14+
channel: ${{ parameters.channel }}
15+
16+
- stage: scan_${{ parameters.channel }}
17+
displayName: SDL - ${{ parameters.channel }}
18+
dependsOn: build_${{ parameters.channel }}
19+
jobs:
20+
- template: ./scanJob.yml
21+
parameters:
22+
channel: ${{ parameters.channel }}
23+
24+
- stage: Push_${{ parameters.channel }}
25+
displayName: Push - ${{ parameters.channel }} to ${{ parameters.release }}
26+
dependsOn: scan_${{ parameters.channel }}
27+
jobs:
28+
- template: ./pushJob.yml
29+
parameters:
30+
channel: ${{ parameters.channel }}
31+
release: ${{ parameters.release }}

0 commit comments

Comments
 (0)